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Abstract 

The question of list decoding error-correcting codes over finite fields (under the Hamming metric) 
has been widely studied in recent years. Motivated by the similar discrete linear structure of linear codes 
and point lattices in M. N , and their many shared applications across complexity theory, cryptography, and 
coding theory, we initiate the study of list decoding for lattices. Namely: for a lattice C C M. N , given a 
target vector r G and a distance parameter d, output the set of all lattice points w G C that are within 
distance d of r. 

In this work we focus on combinatorial and algorithmic questions related to list decoding for the 
well-studied family of Barnes-Wall lattices. Our main contributions are twofold: 

1 . We give tight (up to polynomials) combinatorial bounds on the worst-case list size, showing it to be 
polynomial in the lattice dimension for any error radius bounded away from the lattice's minimum 
distance (in the Euclidean norm). 

2. Building on the unique decoding algorithm of Micciancio and Nicolosi (ISIT '08), we give a list- 
decoding algorithm that runs in time polynomial in the lattice dimension and worst-case list size, 
for any error radius. Moreover, our algorithm is highly parallelizable, and with sufficiently many 
processors can run in parallel time only poly-logarithmic in the lattice dimension. 

In particular, our results imply a polynomial-time list-decoding algorithm for any error radius bounded 
away from the minimum distance, thus beating a typical barrier for natural error-correcting codes posed 
by the Johnson radius. 
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1 Introduction 



A linear error-correcting code C of block length N and dimension K over a field F is a if -dimensional 
subspace of F , generated as all F-linear combinations of K linearly independent vectors. The code's 
minimum distance, denoted d(C), is the minimum Hamming distance between any two distinct codewords 
in C, or equivalently the minimum Hamming weight over all nonzero codewords. It is often convenient to 
normalize distances by the dimension, yielding the relative (minimum) distance 5(C) = d(C) /N of the code. 
Similarly, a point lattice of dimension N and rank K (where often K = N) is a discrete additive subgroup 
of R N (or C ), generated as all integer linear combinations of K linearly independent vectors. The lattice's 
minimum distance X(C) is the minimum Euclidean norm over all nonzero lattice points x G C. Here it 
can also be convenient to normalize by the dimension, and for a closer analogy between the Hamming and 
Euclidean distances, in what follows we work with the relative squared distance (abbreviated rsd) 5(x, y) = 
5(x — y) on or C^, where 5(z) = jf\\z\\ 2 = ^ S^il z «| 2 - The relative squared minimum distance 
(abbreviated rsmd) 5(C) of a lattice is therefore 5(C) = X(C) 2 /N. 

Codes and lattices are intensely studied objects, with many applications in computational complexity, 
cryptography, and coding theory. In particular, both kinds of objects can be used to encode data so that it 
can be recovered reliably after being sent over a noisy channel. A central question associated with codes 
is unique decoding: given a received word r G ¥ N within relative Hamming distance less than 5(C)/ 2 of 
some codeword w G C, find w. Similarly, the unique (also known as bounded-distance) decoding problem 
on lattices is: given a received word r G M. N within rsd less than 5(C) /A of some lattice vector v G C, find 
v. (Note that the 1/4 factor arises because distances are squared in our formulation.) 

For error-correcting codes, Elias lTT4l and Wozencraft [48 ] proposed extending the classical unique de- 
coding problem to settings where the amount of error could cause ambiguous decoding. More precisely, the 
goal of list decoding is to find all codewords within a certain relative distance (typically exceeding d(C) /2) 
of a received word; in many cases, the list is guaranteed to contain few codewords. The first breakthrough 
algorithmic list decoding results were due to Goldreich and Levin lfl7l for the Hadamard code, and to Su- 
dan ll42l and Guruswami-Sudan ll24l for Reed-Solomon codes. These results and others have had countless 
applications, e.g., in building hard-core predicates for one-way functions lfT7l . in hardness amplification B31 . 
in learning Fourier coefficients ll30l[T6l l2l. and in constructing randomness extractors fl46ll4"71l26l . 

There are two central tasks associated with list decoding: combinatorially bounding the number of 
codewords within a given radius of a received word, and algorithmically finding these codewords. An 
important question in understanding list decodability is finding the list-decoding radius of the code, i.e., 
the maximum distance from a received word within which the number of codewords is guaranteed to be 
polynomial in the input parameters. 

The Johnson bound. Under the Hamming metric, the Johnson bound gives a distance up to which list 
decoding is guaranteed to be combinatorially efficient. One version of the Johnson bound states that for any 
code C of relative distance 5, a Hamming ball of relative radius J(5) — e contains at most 1/e 2 codewords, 
and a ball of relative radius J(5) contains at most <5iV 2 |F| codewords, where J(5) = 1 — y/1 — 6. The 
Johnson bound is generic since it does not use any structure of the code (not even linearity), and in many 
cases it is not necessarily the same as the list-decoding radius. It is, however, a barrier in the current 
analysis of combinatorial list decoding for many well-studied families like Reed-Solomon codes, algebraic 
geometry codes, Chinese remainder codes, and others. The breakthrough works of Parvaresh-Vardy ll36l 
and Guruswami-Rudra ll23l gave families of codes which could be (efficiently) list decoded beyond the 
Johnson bound, and were followed by several related combinatorial and algorithmic results for other codes 
(e.g., gJ[l9j|29j[T8l). For more detailed surveys on list decoding of codes we refer to B3ll20ll2l1l22l . 
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1.1 Contributions 



Motivated by the common discrete linear structure of codes and lattices, we initiate the study of list decoding 
for lattices, from both a combinatorial and algorithmic perspective. Conway and Sloane [7 ] promoted the 
applicability of lattices in practice as alternatives to codes. Therefore, our study is motivated by practical 
applications in error-tolerant communication, but primarily by the naturalness of the list-decoding problem 
from a mathematical and computational perspective, and we hope that our work will find other applications 
in theoretical computer science. 

In this work we focus on the Barnes-Wall (BW) 01 family of lattices in C , which have been well- 
studied in coding theory (see, e.g., Il27ll28l l3l l35ll40l ) and share many connections to the Reed-Muller P4l 
[39l family of error-correcting codes (we elaborate below). Barnes-Wall lattices were first constructed in 
order to demonstrate dense sphere packings, a feature that makes them useful in communications settings. 
Minimum-distance decoding algorithms for BW lattices were given in |[27ll38ll4ll . but they are either for 
fixed low dimensions or have runtimes exponential in the lattice dimension N. Micciancio and Nicolosi ll33l 
gave the first poly(iV)-time algorithms for bounded-distance (unique) decoding of any BW lattice up to 5/4 
relative error, along with parallel versions which run in as little as polylog(iV) parallel time on sufficiently 
many processors. They also posed list decoding of BW lattices as an open problem. 

Our main contributions are twofold: 

1. We give tight (up to polynomials) combinatorial bounds on the worst-case list size for BW lattices, 
showing it to be polynomial in the lattice dimension N for any relative squared distance (rsd) bounded 
away from the rsmd 5 of the lattice. (See Theorems 11.21 and 1 1 . 3 1 below for precise statements.) We 
note that it was already known that the list size is super-polynomial jV®( logAr ) when the rsd equals 5 
(see, e.g., (7J Chapter 1, §2.2, page 24]). 

2. We give a corresponding list-decoding algorithm that, for any rsd, runs in time polynomial in the lat- 
tice dimension and worst-case list size. Our algorithm is a variant of the Micciancio-Nicolosi unique- 
decoding algorithm, and as such it is also highly parallelizable: with sufficiently many processors it 
runs in only poly-logarithmic 0(log 2 N) parallel time. 

We note that Johnson-type bounds for lattices are known and easy to obtain (in fact, the Johnson bound 
for codes under the Hamming metric is typically proved by reducing it to a packing bound in M. N under the 
Euclidean norm; see, e.g., (5l|25l|44l[32l). For a lattice C C with rsmd 5, the list size for rsd 5 ■ (| — e) 
is at most and for rsd | is at most AN (see Lemma |23T ). Interestingly, the latter bound is tight for BW 
lattices (see Corollary I2.4I ). Since 6 = 1 for every BW lattice, our combinatorial and algorithmic results for 
rsd up to 1 therefore apply far beyond the Johnson bound. 

To describe our results in more detail, we need to define Barnes-Wall lattices. Let G = Z[i] be the ring 
of Gaussian integers, and let = 1 + i G G. 

Definition 1.1 (Barnes-Wall lattice). The nth Barnes-Wall lattice BW n C G N of dimension N = 2 n is 
denned recursively as BWo = G, and for positive integer n > 1 as 

BW n = {[u,u + (f)v]:u,v e BW n _i} . 

One can check that BW n is a lattice; indeed, it is easy to verify that it is generated as the G-linear 
combinations of the rows of the n-fold Kronecker product 
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A simple induction proves that the minimum distance of BW n is y/~N, i.e., its rsmd is 5 = 10 Also observe 
that if [u, w = u + 4>v\ G BW„ for u,w G C N ^ 2 , then [tw, u] G BW n : indeed, we have w, —v G BW n _i 
and so [w, u = w + (j> • —v] G BW n . The mathematical and coding properties of Barnes-Wall lattices have 
been studied in numerous works, e.g., ifTl 17112711281 1331 l40ll4Tll33l. 

Combinatorial bounds. Let £(rj, n) denote the worst-case list size (over all received words) for BW n at 
rsd rj. We prove the following upper bound. 

Theorem 1.2. For any integer n > and real e > 0, we have 

£{l - e,n) < 4 • (l/e) 16n = jV°0°s(i/<O). 
Moreover, we show that the above bound is tight, up to polynomials. 
Theorem 1.3. For any integer n > and e G [2~ n , 1], we have 

£(l-e,n) > 2(™- lo S7) lo si. 
In particular, for any constant e > (or even any e > N~ c for c < 1), we have £{1 -e,n) = Ar^dA)). 

As previously mentioned, it is also known that at rsd rj = 1, the maximum list size £(l,n) is quasi- 
polynomial _/V e ( log7V ) in the lattice dimension, and is achieved by letting the received word be any lattice 
point [7, Chapter 1, §2.2, page 24]. Because the rsmd of BW n is exactly 1, here we are just considering the 
number of lattice points at minimum distance from the origin, the so-called "kissing number" of the lattice. 

List-decoding algorithm. We complement the above combinatorial bounds with an algorithmic counter- 
part, which builds upon the unique (bounded-distance) decoding algorithm of Micciancio and Nicolosi ll33l 
for rsd up to \. 

Theorem 1.4. There is a deterministic algorithm that, given any received word r G and r\ > 0, outputs 
the list of all points in BW n that lie within rsd rj ofr, and runs in time 0(N 2 ) ■ £(r), n) 2 . 

We also remark that the algorithm can be parallelized just as in 11331 , and runs in only poly logarithmic 
0(log 2 N) parallel time on p > N 2 ■ £(rj, n) 2 processors. 

Theorems 1 1 .21 and 1 1 .41 immediately imply the following corollary for rj = 1 — e. 

Corollary 1.5. There is a deterministic algorithm that, given a received word r G and e > 0, outputs 
the list of all lattice points in BW n that lie within rsd (1 — e) ofr, and runs in time (l/e)°( n ! = /AT ( lo s( 1 / e )). 

Given the lower bounds, our algorithm is optimal in the sense that for any constant e > 0, it runs in 
poly(iV) time for rsd 1 — e, and that list decoding in poly(iV) time is impossible (in the worst case) at rsd 1. 

'The fundamental volume of BW„ in is det(W / ) = 2" JV//2 , so its determinant-normalized minimum distance is 
y/N/ det(W) 1/{2N) = xYN. This is better than the normalized minimum distance 1 of the integer lattice G*, but worse that 
the largest possible of Q(\/N) for iV-dimensional lattices. 
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1.2 Proof Overview and Techniques 

Combinatorial bounds. Our combinatorial results exploit a few simple observations, some of which were 
also useful in obtaining the algorithmic results of ll33l . The first is that by the Pythagorean theorem, if 
7] = 5(r, w) is the rsd between a received vector r = [ro, n] G and a lattice vector w = [wq, w\] G BW„ 
(where r, G C 7 ^ 2 and tOj G BW n -i), then d(rb,Wf,) < r/ for some 6 G {0, 1}. The second observation 
(proved above) is that BW lattices are closed under the operation of swapping the two halves of their vectors, 
namely, [wo,^i] G BW„ if and only if [u;i,w;o] G BW n . Therefore, without loss of generality we can 
assume that 5(ro, wq) < rj, while incurring only an extra factor of 2 in the final list size. A final important 
fact is the relationship between the rsd's for the two Barnes-Wall vectors u = wq, v = ^(wi—wq) G BW n _i 
that determine to; namely, we have 

V = i<ty*o,«) + 8($(ri ~ u),v). 

(See Lemma |2Tl ) Since S(ro, u) < rj, we have must have S(\(n — u),v) = rj — ^5(tq,wo) G [rj/2, rj]. 

Our critical insight in analyzing the list size is to carefully partition the lattice vectors in the list according 
to their distances from the respective halves of the received word. Informally, a larger distance on the left 
half (between ro and u) allows for a larger list of it's, but also implies a smaller distance on the right half 
(between ^(ri — it) and v), which limits the number of possible corresponding u's. We bound the total list 
size using an inductive argument for various carefully chosen ranges of the distances at lower dimensions. 
Remarkably, this technique along with the Johnson bound allows us to obtain tight combinatorial bounds on 
the list size for distances all the way up to the minimum distance. 

As a warm-up example, which also serves as an important step when analyzing larger rsd's, Lemma 1231 
gives a bound of £(§,n) < 4 • 24 n = poly(iV) for rsd rj = I . This bound is obtained by partitioning 
according to the two cases 5(ro,u) G [0, ^) and <5(ro, it) G |], which imply that the rsd between v and 
■z(t\ — u) is at most | and respectively. When bounding the corresponding number of it's and v's, the 
rsd's up to ^ < i are handled by the Johnson bound, and rsd's up to | are handled by induction on the 
dimension. 

To extend the argument to rsd 's up to r\ = 1 — e, we need to partition into three cases, including ones 
which involve rsd's 1 — % and |. In turn, the bound for rsd | also uses three cases, plus the above bound 
for rsd |. Interestingly, all our attempts to use fewer cases or a more direct analysis resulted in qualitatively 
worse list size bounds, such as _/V°( log C 1 /*)) or worse. 

Lastly, our lower bounds from Theorem 11.31 are obtained by using a representation of BW lattices in 
terms of RM codes (see Fact l2.7l) . and by adapting the lower bounds from |fl9l for RM codes to BW lattices. 

List-decoding algorithm. A natural approach to devising a list-decoding algorithm using the above facts 
(also used in the context of Reed-Muller codes [HI) is to first list decode the left half ro of the received 
word to get a list of it's, and then sequentially run through the output list to decode the right half 4(n — u) 
and get a corresponding list of u's for each value of u. However, because the recursion has depth n, the 
straightforward analysis reveals a super-polynomial runtime N^ n > for rsd 7] > 1/2, because the list size at 
depth d can be > 4A^/2 d . 

Instead, our list-decoding algorithm is based on the elegant divide-and-conquer algorithm of ll33l for 
bounded-distance (unique) decoding, which decodes up to half the minimum distance (i.e., rj = \) in quasi- 
linear O(N) time, or even poly-logarithmic 0(log c N) parallel time on a sufficiently large poly(A r ) number 
of processors. 



4 



The main feature of the algorithm, which we exploit in our algorithm as well, is the use of a distance- 
preserving linear automorphism T of the BW lattice, i.e., T(BW n ) = BW n (see Fact 13. II ). In particular, 
a lattice vector w £ BW„ can be reconstructed from just one arbitrary half of each of w = [wq,w\] and 
T(w) = [To(w), 71 (w)]. Recall that for a received word r = [ro, r{\ (where r.j £ C N ^ 2 ), we are guaranteed 
that 5(rb,Wb) < 6(r,w) for some b £ {0, 1}, and similarly for 7~(r) and T(w). These facts straightfor- 
wardly yield a divide-and-conquer, parallelizable list-decoding algorithm that recursively list decodes each 
of the four halves ro, ri, ?b(r), T\(r) and reconstructs a list of solutions by combining appropriate pairs 
from the sub-lists, and keeping only those that are within the distance bound. The runtime of this algorithm 
is only quadratic in the worst-case list size, times a poly(iV) factor (see Section [3]). We emphasize that the 
only difference between our algorithm and the MN algorithm is the simple but crucial observation that one 
can replace single words by lists in the recursive steps. The runtime analysis, however, is entirely different, 
because it depends on the combinatorial bounds on list size. 

1.3 Comparison with Reed-Muller Codes 

Here we discuss several common and distinguishing features of Barnes-Wall lattices and Reed-Muller codes. 

Definition 1.6 (Reed-Muller code). For integers d, n > 0, the Reed-Muller code of degree d in n variables 
(over F2) is defined as 

RMj[ = {(p(a)) a& n :pe ¥ 2 [xi, . . . ,x n ],deg(p) < d} . 
An equivalent recursive definition is RM^ = {0, 1} C F 2 ,™ for any integer n > 0, and 

RM^ = |[u, u + v] : u £ RM^, v £ RM^} . 

Here if u G RM^_ l5 v G RM^~^ coiTespond to polynomials p u ,p v £ F2[xi, . . . x n -±) respectively, then the 
codeword [u, u + v] G RM^ corresponds to the polynomial p = p u + x n ■ p v £ F2[xi, . . . , x n \. 

The recursive definition of RM codes already hints at structural similarities between BW lattices and 
RM codes. Indeed, BW lattices can be equivalently defined as evaluations modulo (\> n of (Gaussian) integer 
multilinear polynomials in n variables over the domain {0, <p} n . Recall that an integer multilinear polyno- 
mial p £ G[xi, . . . , x n ] is one whose monomials have degree at most one in each variable (and hence total 
degree at most ri), i.e., 

p(x 1 ,...,X n ) = ^ a S-Y[ X i 

5e{o,i} n *es 

where each as £ G. A simple inductive argument proves the following lemma. 

Lemma 1.7. BW n = 0™G 2 ™ + {(p(^))ze{o,</>} n : P £ . . . , x n ] is multilinear}. 

Thus, while RM^ codewords correspond to low-degree polynomials (when d is small), BW lattice points 
correspond to possibly high-degree polynomials. As an immediate application, our main theorems imply 
the following corollary regarding the set of integer multilinear polynomials that approximate a function 

/: {0,0}" ^C. 

Corollary 1.8. Given a map f : {0, (p} n — > C (represented as a lookup table) and e = £l(N~ c ) for some 
c < 1 and N = 2 n , there exists an algorithm that outputs in time N ^ ^ 1 ^^ all the integer multilinear 
polynomials g: {0, (f)} n — > C such that \\f — g\\ 2 < (1 — e)N. 
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Just as in our algorithmic results for BW lattices, the recursive structure of RM codes is critically used 
in list-decoding algorithms for these codes, but in a different way than in our algorithm. The list-decoding 
algorithm for RM^ given in |fl9l recursively list decodes one of the halves of a received word, and then 
for each codeword in the list it recursively list decodes the other half of the received word. The recursion 
has depth d and thus has a total running time of poly(iV) • £(rj) , where t{rf) is the list size at relative 
(Hamming) distance rj. As mentioned above, a similar algorithm can work for BW lattices, but the natural 
analysis implies a super-polynomial £(r]) n lower bound on the running time, since now the recursion has 
depth n. The reason we can overcome this potential bottleneck is the existence of the linear automorphism 
T of BW n , which allows us to make only a constant number of recursive calls (independently of each other), 
plus a poly(iV) • £(ry) 2 -time combining step, which yields a runtime of the form 0(1)™ • poly(iV) • £{j]) 2 = 



We note that RM^ codes are efficiently list decodable up to a radius larger than the minimum dis- 
tance QiO , and remark that while RM codes are some of the oldest and most intensively studied codes, it 
was not until recently that their list-decoding properties have been very well understood |[37l[T9l[29ll . 

1.4 Other Related Work 



Cohn and Heninger [6] study a list-decoding model on polynomial lattices, under both the Hamming metric 
and certain 'non-Archimedian' norms. Their polynomial analogue of Coppersmith's theorem ||8 ] implies, as 
a special case, Guruswami and Sudan's result on list decoding Reed-Solomon codes l24ll . 

Decoding and list decoding in the Euclidean space has been also considered for embeddings into real 
vector spaces of codes classically defined over finite fields. These embeddings can give rise to so-called 
spherical codes, where the decoding problem has as input a received vector on the unit sphere, and is 
required to output the points in the code (also on the unit sphere) that form a small angle with the given 
target. Another related decoding model is soft-decision decoding, where for each position of the received 
word, each alphabet symbol is assigned a real-valued weight representing the confidence that the received 
symbol matches it. Soft decision unique decoding for RM codes was studied in iPTTl [T3l [121 . and list- 
decoding algorithms were shown in lfl0l[T5ll . 

Further, the question of decoding lattices is related to the well-studied vector quantization problem. In 
this problem, vectors in the ambient space need to be rounded to nearby points of a discrete lattice; for 
further details on this problem see, for example, Q. 

Organization. In Section |2] we prove our combinatorial upper and lower bounds for BW lattices. In 
Section[3]we present and analyze our main list-decoding algorithm. We conclude with several open problems 
in Section HI 

2 Combinatorial Bounds 

We start with a few basic definitions. For a lattice C, a vector r G C m (often called a received word) and any 
rj > 0, define Lc(r, rj) = {x E C : 5(r, x) < i]} to be the list of lattice points w G C such that 5(r, w) < i]. 
We often omit the subscript C when the lattice is clear from context. For r\ > and nonnegative integer n 
with N = 2 n , we define £(r), n) = max re c™ |-^bw„ {f, rj) | to be the maximum list size for rsd r], for the nth 
Barnes-Wall lattice. 



poly(iV) • £(rj) 2 . 
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2.1 Helpful Lemmas 



We start with two simple but important observations about Barnes-Wall lattices. The first relates the rsd's 
between the respective "left" and "right" halves of a received word and a lattice point. The second relates 
the list sizes for the same rsd but different dimensions. 

Lemma 2.1. Let r = [r ,ri] G with r ,n G C N/2 , and w = [u,u + <jyu] G BW n for u,v G BW n -i. 
Let rj = 5(r, w), rj = 5(r ,u) and rji = <5(4(ri — u), v). Then rj = ^ + r]i. 

Proof. We have 

. <y(r Oj u) + «5(ri,« + 0«) vo , \<t>\ 2 ' 5 (l( r i - u),v) m 
S(r,w) = = T + 2 = T + r?1 ' 

Lemma 2.2. For a«y 77 > and n > 1, we have £(r], n — 1) < £(77, n). 

Proof. Let r G C^/ 2 and u; G L(r, rf) C BW n _i. Then 5([r, r], [to, u;]) = 5(r, u;), and since [u;, w;] G BW n 
(because w G BW n _i) it follows that [w, w] G L([r, r],rj). □ 

We next state a Johnson-type bound on the list size for arbitrary lattices; see, e.g., |25l @4l [32l for 
proofs. Note that these sources work in M. N ; our form follows because the standard isomorphism between 
and M? N as real vectors spaces also preserves Euclidean norm. 

Lemma 2.3 (Johnson bound). Let C C be a lattice o/rsmd 5 = 5(C) and let r G C^. Then 

1. \L(r, |)| < 4JV, and 

2. \L(r,5-(\-e))\<±-Joranye>tt. 

(In reading these bounds, recall that 5(C) /A, not 5(C) /2, is the relative unique-decoding distance of C, 
because 5(C) is the relative squared minimum distance of the lattice.) 

Corollary 2.4. For the lattice BW n C and any e > 0, we have £(h,n) = AN and £(l — e, n) < 

Proof. Since 5(BW n ) = 1, the upper bounds follow immediately by Lemma 1231 For the equality n) = 
4iV, an easy inductive argument shows that |L(r, |)| = 4N for the received word r = (|,...,|) G 
C N . □ 



2.2 Beyond the Johnson Bound 

In this section we prove our main combinatorial bounds on the list size for Barnes-Wall lattices BW„ C G N . 
Our main result is that the list size at rsd (1 - e) is (l/e)°( n ) = N°Q-°&0-/ e )) for any e > 0. The proof 
strategy is inductive, and is based on a careful partitioning of the lattice vectors in the list according to the 
distances of their left and right halves from the respective halves of the received word. Intuitively, the larger 
the distance on one half, the smaller the distance on the other (Lemma |2~T1 above makes this precise). The 
total list size can therefore be bounded using list bounds for various carefully chosen distances at lower 
dimensions. Our analysis relies on a poly(iV) list-size bound for rsd |, which in turn relies on a poly(iV) 
bound for rsd |. We first prove these simpler bounds, also using a partitioning argument. (Note that the 
concrete constants appearing below are chosen to simplify the analysis, and are likely not optimal.) 

Lemma 2.5. For any integer n > 0, we have 1(1, n) < 4 • 24 n . 
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Proof. The claim is clearly true for n = 0, so suppose n > 1 with iV = 2 n . Let r = [ro,ri] G with 
vq,vi G C^/ 2 be an arbitrary received word, and let w = [u, u + 4>v] G L(r, |) for u, v G BW n „i. Let 
77 = <5(r,w) < |, 770 = S(r ,u) and 771 = <5(|(n 

Note that 77 = |(<5(rrj,u) + <5(ri,u + cf)v)) < |. Without loss of generality, we can assume that 
r/o = 5(ro,u) < |. For if not, then we would have 5{r\,u + <pv) < |, and since [a, b] G BW n implies 
\b, a] G BW n for a, b G G N I 2 , we could instead work with the received word r' = [77, r ] and w' = 
[u + <f)v, u] G L(r', |). This incurs a factor of at most 2 in the total list size, which we account for in the 
analysis below. 

Assuming 770 < |, we now split the analysis into two cases: 770 G [0,^), and 770 G §]• By 
Lemma |2T] these cases correspond to 771 < | and 771 < ^, respectively. Since u G L(ro,r]o) and v G 
L ( i (n — u) , 771 ) , after incorporating the factor of 2 from the argument above we have (where for conciseness 
we write £(r]) for £(rj, n — 1)): 

<(|,n)< 2- (/(^)-i(j) +/(§)• /(^)) 
= 4-^)^(|) 
<4.6-*(§) 
<24™.£(§,0), 

where the penultimate inequality is by Corollary 12.41 and the final one is by unwinding the recurrence. □ 
Lemma 2.6. For any integer n > 0, we have£{\,n) < 4 • 24 2n . 

Proof. The claim is clearly true for n = 0, so suppose n > 1; we proceed by induction on n. Define the 
same notation as in the proof of Lemma 1231 using rsd bound | instead of |. 

As before, we assume that r] < | and account for the accompanying factor of 2 in the list size. This 
time we split the analysis into three cases: 770 G [0, \), 770 G [3, |), and 770 G [|, f ]. By Lemma |2~T1 these 
correspond to 771 < |, 771 < |, and 771 < ^, respectively. 

For conciseness, in the calculation below we write ^(77) for ^(77, n — 1). Using Corollary I2.4L Lemma l2~31 
and the inductive hypothesis, we have 

t&n) < 2 • (£(\) • /(|) + /(f) • £(l) + 1(1) • /(A)) 

< 2- (2 + 8) .€(§) + 2 .*(§) 2 

< 20 • 4 • 24 2(n ~ 1) + 32 • 24 2(n_1) 

< 4-24 2n . □ 
We are now ready to prove our main combinatorial bound. 

Proof of Theorem lL2\ We need to show that £(1 — e, n) < 4 • (l/e) 16n for any n > and e > 0; obviously, 
we can assume e < 1 as well. The claim is clearly true for n = 0. We proceed by induction on n; namely, 
we assume that for all 7 > it is the case that £(1 — 7, n — 1) < 4 • (l/^) 16 ^" 1 ). Define the same notation 
as in the proof of Lemma 1231 using rsd bound 1 — e instead of |. 

As in earlier proofs, we assume that 770 < 1 — e and account for the accompanying factor of 2 in the list 
size. We split the analysis into 3 cases: 770 G [0, \ — e), 770 G [\ — e, 1 — y), and 770 G [1 — ^, 1 — e]. By 
Lemma l2Tl these correspond to 771 < 1 — e, 771 < | — | < |, and 771 < \ — |, respectively. 
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For conciseness, in the calculation below we write £(rj) for £(r], n — 1). Using Corollary I2.4L Lemma l2T6l 
and the inductive hypothesis, it follows that £(1 — e, n) is bounded by 



2 (£(l - e)l{\ - e) + £{l - e)£{\ - f ) + £{l - f )£{\ )) 



< 2£{1 - e)(i + |) + 2£{l - |) • 4 • 24 2 ( n " 1} 



= § • £(1 - e) + 8 • 24 2 ( n ~ 1 ) • £{l - f) 



20 . /l\16(n-l) , no . o 4 2(n-l) _ (JiN^n-l) 



= (I)16(n-1) . (20 + 32 . (24 2 . (2)16)(n-l)-) 



< fh!6(n-l) . (-52-j 



< 4. (I)16n 



when e < |. If e G (f , 1] then ^(1 - e, n) = 1 < 4 • (\) 16n , and the proof is complete. 



□ 



Notice that in the above proof, it is important to use an upper bound like rj < 1 — ^ in one of the 
cases, so that the factor (|) 16 ( n ~ 1 ) from the inductive list bound can cancel out the corresponding factor of 
24 2 ( n_1 ) for the corresponding rsd bound r}\ < |. This allows the recurrence to be dominated by the term 



«(l-c)./(i-f) = 0(!).*(l- c ), 



yielding a solution of the form (l/e)°( n \ 
2.3 Lower Bounds 

For our lower bounds we make use of a relationship between Barnes-Wall lattices and Reed-Muller codes, 
and then apply known lower bounds for the latter. 



where the embedding of ¥2 into C is given by 1— > and 1 1— >■ 1. In particular, any codeword G RM% 
gives rise to a lattice point (j) d ■ Cd G BW n , 



Fact 2.8 (El Chap. 13, §4]). 

1. The minimum distance of RM d is 2 n ~ d . In particular, the characteristic vector cy G F 2 .™ of any 
subspace V C FJ> of dimension k > n — d is a codeword ofRM d . 

(The characteristic vector cs G F| of a set S Q¥^ is defined by indexing the coordinates o/F 2 .™ by 
elements a G FJ,, and letting (cs) a = 1 if and only if a G S.) 



Fact 2.7 ((271 §IV.B]). 




c n , with Cd G RM^, < d < n — 1, and c n G G 




2. There are 2 d • 



n-d-l 2 n ~ % — 1 



> 2 d ^ n d ) subspaces of dimension n — din FJ?. 



Al on— d— j 1 

i=0 * — 1 
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Proof of Theorem [PI Let k > be an integer such that 2 n e < 2 k < 2 n+l e. Let the received word be 
r = 4> k ■ [1,0,... ,0] G where we assume that the first coordinate is indexed by n G F?j. By Fact 12. 81 
and Fact |2.7[ for any subspace if C F?? of dimension n — fc, we have (fr ■ ch G BW n . Notice that 

|| r _ <J) k . CH ||2 = . || CH _ [1, 0, . . . , 0] || 2 = 2 fc • (2 n " fc - 1) = 2 n - 2 k < 2 n (l - e). 

By Fact EH there are at least 2 k( - n ~ k ^ > 2 (n " log ^ log 57 subspaces H C F£ of dimension n — k, which 
completes the proof. □ 

3 List-Decoding Algorithm 

In this section we prove Theorem 11.41 by giving a list-decoding algorithm that runs in time polynomial in 
the list size; in particular, by Theorem 1 1.21 it runs in time iVOQogC 1 / 6 )) for rsd (1 — e) for any fixed e > 0. 
The runtime and error tolerance are optimal (up to polynomial overhead) in the sense that the list size can 
be jV^ 10 ^ 1 ^)) by Theorem [OJ and can be super-polynomial in N for rsd 1 or more. 

The list-decoding algorithm is closely related to the highly parallel Bounded Distance Decoding algo- 
rithm of Micciancio and Nicolosi 11331 , which outputs the unique lattice point within rsd 77 < | of the 
received word (if it exists). In particular, both algorithms work by recursively (and independently) decoding 
four words of dimension N/2 that are derived from the received word, and then combining the results ap- 
propriately. In our case, the runtime is strongly influenced by the sizes of the lists returned by the recursive 
calls, and so the combinatorial bounds from Section |2] are critical to the runtime analysis. 

We need the following easily- verified fact regarding the symmetries (automoiphisms) of BW n . 

Fact 3.1. For N = 2 n , the linear transformation T : — > C N given by T~([u,v]) = % ■ [u + v, u — v] is a 
distance-preserving automorphism ofBW n , namely T(BW n ) = BW n and 5(x) = 5(T(x)) for all x G C . 



Algorithm 1 ListDecodeBW: List-decoding algorithm for Barnes-Wall lattices. 

Input: r eC N (for N = 2") and rj > 0. 
Output: The list L(r, 77) C BW n . 
1: if n = then 

2: output L(r, ry) C G by enumeration. 

3: parse r = [ro,ri] for rrj, n G C N ^ 2 , and let r + = f (rrj + n) and r_ = ^(ro — ri), so [r+, r_] = T(r). 

4: for all j G {0,1,+,-} do 

5: let Lj = ListDecodeBW (rj, rj). 

6: for each (b, s) G {0,1} x {+,— } and each pair (wb,w s ) G Lb x L s , compute the corresponding 
candidate vector w = [wq, w\] G BW n as the appropriate one of the following: 

[w , §w + - w ] , [w ,w - ^W-], 
[^w+-w 1 ,w 1 ] , [%W- + W 1 ,W 1 ]. 

7: return the set L of all the candidate vectors w such that S(r, w) < 77. 



Proof of Theorem \L~4\ We need to show that on input r G and 77 > 0, Algorithm [Qruns in time 0(N 2 ) ■ 
£(rj, n) 2 and outputs L = L(r, 77). 
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We first prove correctness, by induction. The algorithm is clearly correct for n = 0; now suppose that 
n > 1 and the algorithm is correct for n — 1. Adopt the notation from Algorithm [Q and let w = [wo, w\] G 
L(r, rj) for wq, w\ G BW n _i be arbitrary. Since 5(w, r) < w, we have <5(ro, wq) < rj or 8{r\, w\) < rj or 
both, so wo G L(ro,?]) or G L{r\,rj) or both. The same is true about the corresponding vectors after 
applying the automorphism T. Namely, letting «;_] = T(u>) G BW n for w + ,W- G BW n _i, we have 
[w+, W-] G L([r + , r_], 77) and so w + G L(r+, rj) or w_ G L(r~, rj) or both. 

By the inductive hypothesis and the above observations, we will have (wb, w s ) G Lb x L s for at least 
one choice of (b, s) G {0, 1} x {+, — }. The algorithm calculates the vector w = [wq,w\] as a candidate, 
simply by solving for wq, w\ using Wb, w s and the definition of T ■ Therefore, w will appear in the output 
list L. And because L C L(r, rj), the claim follows. 

We now analyze T(n), the number of operations over C for an input of dimension N = 2 n , which is 
easily seen to satisfy the recurrence 



T{n) < 4T(n - 1) + 4 • £(r], n - l) 2 • 0(2 n " 1 ) < 4 n • T(0) + 4* • £(r/, n - if ■ 0(2 n ^) 

i=i 

n 

< 0(iV 2 ) + 0(2 n ) • ^(r?, n - l) 2 • 2* = 0{N 2 ) ■ £(n, n - if . □ 



i=l 



Remark 3.2. We note that the above algorithm, like the unique decoder of B31 . can be easily parallelized. 
The parallel time on p processors (counting the number of operations in C) satisfies the recurrence 



T(n,p) 



T{n) ifn = 0orp<4 

T(n - l,p/4) + 0(N ■ £(n,n- lf/p + logN) otherwise, 



where T(n) is the sequential time computed in Theorem ll.4l This is because it takes 0(N • £(rj, n — if /p) 
time per processor to combine the lists in Step|6]of the algorithm, and computing the £(rj, n — if distances 
in Step |7] requires computing sums of N terms in C, and takes a total of 0(N ■ £(n,n — if jp + logA^) 
parallel time. Notice that when p > N 2 ■ £{n, n — if, the algorithm runs in only polylogarithmic 0(log 2 N) 
parallel time. Note also that when the list size £(n, n — 1) = 1, our analysis specializes exactly to that 

of ea. 



4 Discussion and Open Problems 

Some immediate open questions arise from comparison to the results in ll33l . Motivated by the sequential 
unique decoder proposed in 11331 . is there a (possibly sequential) list decoder that runs in time quasilinear in 
N and the list size, rather than quadratic? Also, as asked in l33l . is there an efficient algorithm for solving 
the Closest Vector Problem (i.e., minimum-distance decoding) on Barnes-Wall lattices? Note that our lower 
bounds do not rule out the existence of such an algorithm. 

An important variant of the list-decoding problem for codes is local list decoding. In this model, the 
algorithm is required to run in time polylogarithmic in the block length, and output succinct representations 
of all the codewords within a given radius. Defining a meaningful notion of local decoding for lattices (and 
BW lattices in particular) would require additional constraints, since lattice points do not in general admit 
succinct representations (since one needs to specify an integer coefficient for each basis vector). While by 
the Johnson bound we have a poly(n) list size for rsd up to 1/2 — poly(l/n), achieving a meaningful notion 
of local decoding in this context would be interesting. 
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Another interesting direction is to find (or construct) more asymptotic families of lattices with nice list- 
decoding properties. In particular, are there generic operations that when applied to lattices guarantee good 
list-decoding properties? For codes, list decodability has been shown to behave well under the tensoring 
and interleaving operations, as demonstrated in |[T8l . Since at least tensoring is also well-defined for lattices, 
understanding its effect in the context of list decoding is a natural further direction. 

Finally, it would be also interesting and potentially useful to consider list decoding for norms other than 
the Euclidean norm, such as the i^, or £q norms. 
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